To: 


Of: 


ICO. 


Information Commissioner’s Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Digital Growth Experts Limited 


International House, 12 Constance Street, London E16 2DQ 


The Information Commissioner (“Commissioner”) has decided to issue 
Digital Growth Experts Limited (“DGE”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is in 
relation to a serious contravention of Regulations 22 and 23 of the 
Privacy and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


DGE, whose registered office is given above (Companies House 
Registration Number: 12373841) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Regulation 23 of PECR states that “A person shall neither transmit, nor 


instigate the transmission of, a communication for the purposes of 


direct marketing by means of electronic mail - 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 


concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 


communications cease has not been provided 


(c) where that electronic mail would contravene regulation 7 of 
the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation.” 


Section 11(3) of the DPA defines “direct marketing” as “the 
communication (by whatever means) of any advertising or marketing 
material which is directed to particular individuals”. This definition also 


applies for the purposes of PECR (see regulation 2(2)). 


Consent is defined in the European Directive 95/46/EC as “any freely 
given specific and informed indication of his wishes by which the data 
subject signifies his agreement to personal data relating to him being 


processed”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


Section 55A of the DPA (as amended by the Privacy and Electronic 
Communications (EC Directive)(Amendment) Regulations 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 


of the DPA about the issuing of monetary penalties that has been 
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published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 


that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


Phone users can report the receipt of unsolicited marketing text 
messages to the GSMA’s Spam Reporting Service by forwarding the 
message to 7726 (spelling out “SPAM”). The GSMA is an organisation 
that represents the interests of mobile operators worldwide. The 
Commissioner is provided with access to the data on complaints made 
to the 7726 service and this data is incorporated into a Monthly Threat 


Assessment (MTA) used to ascertain organisations in breach of PECR. 


DGE is a company which was incorporated on 20 December 2019, 
originally under the name of ‘Motorhome Brokers Limited’. The name 
of the company was changed to its present form on 12 February 2020. 
It is not suggested for the purpose of this Notice that the name change 


was related to this contravention. 
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DGE first came to the attention of the Commissioner following a 
number of complaints being received via the 7726 reporting tool; the 
messages received by the complainants promoted a ‘Zoono’ brand 
hand sanitising product, which the messages specifically claimed was 


“effective against coronavirus”. 


‘Zoono.io’ is a website which was set up by DGE to market ‘Zoono’ 
brand products. The website suggests that it is part of the DGE 


“community”, and provides DGE’s contact details for consumer queries. 


An initial investigation letter was sent to DGE on 14 April 2020 raising 
some preliminary concerns with DGE’s PECR compliance, and 
requesting details of the volumes of messages sent to subscribers, and 


sources of data for the recipients of those messages. 


In its response of 27 April 2020, DGE explained that it sells a range of 
products through the ‘Zoono.io’ website, and online marketplaces 
under the trading name of ‘Zoono.io’. In addition, it stated that its 
marketing messages are sent through the ‘Voodoo SMS’ platform, with 
approximately 1,076 messages having been sent between 12 February 
2020 and 16 April 2020. It was claimed that data had been sourced 
using “website lead capture” and from a ‘collated list’ of telephone 
numbers related to previous interactions with the company’s online 
marketplace sales page. In its explanation for the complaints made to 
the 7726 service, DGE stated that “it may be that these users did not 
use the STOP link and presume they were unaware that their numbers 
had been used for subsequent marketing purposes”. The response also 
confirmed that, in light of the ICO’s initial investigation letter, DGE had 
taken steps to register with the ICO. 


Whilst it is noted that the complaints made to the 7726 service showed 
messages which did not offer an ‘opt out’ function, DGE appeared to 
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suggest that its initial texts to the complainants, and to subscribers 
more generally, would have offered this function. In any event, DGE 


stated that it could not demonstrate that the complainants in the 


reported incidents had provided consent to receive direct marketing. 


Subsequent correspondence from DGE was unclear as to the details of 
precisely how it obtained the data of the individuals to whom it would 
send direct marketing messages, save to say that some were sent to 
individuals who had expressed an interest in online marketplace and 
social media offers. DGE’s Director specifically advised that he has had 
an ‘eBay’ account since 2003, and had collated mobile phone numbers 
from that. It was subsequently claimed that data collected from this 
‘eBay’ account was that of individuals who had interacted with offers on 
the Director’s personal page within the last 24 months. With regards to 
the data obtained via social media, the Director later confirmed that he 
would use the data of individuals who had expressed an interest in 
receiving a free sample of hand sanitiser via ‘lead generation type 


adverts’. 


DGE was asked to further clarify the total volume of messages sent by 
the organisation, noting that the most recently provided figures had 
increased somewhat from the 1,076 messages proposed at the outset 
of the Commissioner's investigation. DGE’s response did not supply 


the requested information. 


In an effort to establish the precise volumes of the messages sent by 
DGE, a third party information notice (“3PIN”) was sent to ‘Bulk SMS 
Limited’, the company responsible for the running of Voodoo SMS, the 
platform through which DGE had sent its messages. The response 
indicated that between 29 February 2020 and 30 April 2020 there had 
in fact been 17,241 text messages sent by DGE. Of these, 16,190 text 


messages had been delivered to subscribers. 
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Over the course of the investigation, DGE was unable to provide 
evidence of consent for any of the messages delivered to subscribers 
over the relevant period of 29 February 2020 to 30 April 2020. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulations 22 and 23 of PECR by DGE and, if so, 


whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that DGE contravened regulations 22 and 23 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 29 February 2020 and 30 April 
2020 there were 16,190 direct marketing text messages received by 
subscribers. The Commissioner finds that DGE transmitted the direct 


marketing messages sent, contrary to regulation 22 of PECR. 


The Commissioner is satisfied that the contravention could have been 
higher, with a total of 17,241 text messages being sent over the 


relevant time. 


DGE, as the sender of the direct marketing, is required to ensure that it 
is acting in compliance with the requirements of regulation 22 of PECR, 
and to ensure that valid consent to send those messages had been 


acquired. 
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In this instance DGE have been unable to evidence any such consent, 

instead providing unclear and inconsistent explanations for its practices 

and the means by which it obtains the data used for its direct 

marketing. Indeed, from the information provided, and as far as the 

Commissioner can determine, it appears that DGE has relied on data 

scraped from an online marketplace account belonging to its Director, 

which he had operated since 2003, albeit claiming that the data used 

was obtained only over the previous 24 months. There is no evidence 

that valid consent had been obtained from any of the individuals whose 

data had been used in this way, or that any of the individuals had any 


previous relationship with DGE whatsoever. 


DGE also used data obtained via social media advertisements which 
purported to offer free samples of a product to individuals, and then 
automatically opted them in to receiving direct marketing. From the 
evidence provided, it does not appear that individuals were advised 
that their data would be used for this purpose, nor were individuals 
given a simple means of refusing the use of their contact details for 


this purpose. 


Neither of the above methods of data collection constitutes adequate 
means of obtaining valid consent, and nor would DGE be able to avail 
itself to regulation 22(3) PECR (the “soft opt-in”). 


DGE stated that some of its marketing texts were sent to individuals 
who had previously expressed an interest in ‘eBay’ offers on the 
Director’s account page. It is however, in the Commissioner's view, 
simply not possible that individuals whose data has been held on the 
Director’s own ‘eBay’ account since 2003, or even those who may have 
expressed an interest in unrelated products on this account within the 


previous 24 months, could have provided valid consent to receive 
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direct marketing text messages from DGE in relation to hand sanitiser 
many years later. Indeed, it is unlikely that such individuals would 
have any knowledge of DGE, which is likely not to have even been 
incorporated at the time they expressed an interest in offers on the 
Director’s own page. Rather, it appears to the Commissioner that this 
data has been harvested from records of past auctions involving the 
Director regarding unrelated products, and used by DGE for the 
purposes of reaching as many people as possible in relation to its own 


hand sanitiser marketing campaign. 


The Commissioner is further satisfied that, in any event, DGE cannot 
rely on the ‘soft opt-in’ exemption provided by Regulation 22(3) PECR 
for the purposes of the messages sent to individuals with whom the 
Director of DGE has a prior transaction history. The soft opt-in 
exemption firstly requires that the person sending or instigating the 
electronic mail, i.e. DGE, had obtained the contact details of the 
recipient of that electronic mail in the course of the sale or negotiations 
for the sale of a product or service to that recipient. There has been no 
evidence provided that any of the recipients, some of whom the 
Director has confirmed would have provided details to him years 
earlier, had entered into a sale, or negotiations for a sale, with DGE; 


regulation 22(3) PECR therefore cannot apply. 


In short, DGE has provided no evidence in respect of this data set to 
support a reliance on Regulation 22(3) PECR, or any evidence to 


demonstrate valid consent whatsoever. 


In terms of those individuals who had signed up to receive a sample of 
hand sanitiser through social media platforms, DGE initially provided 
some unspecific information as to how data would be collected. It has 
since been confirmed that individuals would enter their name and 


telephone number through one of these lead generation type adverts 
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and would be required to agree to two privacy policies (Facebook’s and 
that of ‘Zoono.io’). The individual would then receive a text to their 
phone with a voucher code which they would need to separately input 
on ‘Zoono.io’; they would pay postage and receive their free sample. 
However, upon entry of their details at the data collection stage, and 
whether or not individuals chose to redeem the voucher code, 
individuals were automatically, and without notice, opted in to receive 
direct marketing messages from DGE, with multiple messages 


potentially being sent to them. 


Such means of obtaining consent cannot be valid, since the ‘consent’ 
being relied on cannot, at the very least, be said to have been freely 
given; nor can individuals be said to have been given a genuine choice 
as to whether or not they would wish to receive direct marketing when 


signing up to a free sample of the hand sanitiser. 


Furthermore, the ‘soft opt-in’ exemption cannot be relied on for these 
individuals since the act of applying for a free sample cannot be said to 
be a ‘sale’ or ‘negotiation of a sale’. In any event, it appears that DGE 
would send marketing to all individuals who provided their details in 
this way, and not just those who may have chosen to redeem the 
voucher for the free sample. Such subsequent direct marketing would 
fail to meet the criteria of Regulation 22(3)(a) PECR. 


In addition, from the evidence provided it is clear that the individuals 
had not, at the point their data was collected, been given a simple 
means of refusing the use of their contact details for direct marketing; 
accordingly, DGE’s direct marketing would also fail to meet the criteria 
of Regulation 22(3)(c) PECR 


Again, DGE has been unable to demonstrate any evidence of consent 


to send direct marketing messages to those individuals whose data was 
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obtained via social media offers, nor can it rely on Regulation 22(3) 
PECR. 


The Commissioner further notes that the messages do not make clear 
that they are being sent by and on behalf of DGE, rather they either do 
not reference a sender at all or alternatively refer to ‘Zoono’ which is a 
product name and is not a registered trading name of DGE. DGE 
obtained permission to market Zoono products from Zoono Holdings 


Limited, a separate and distinct entity. 


It is also apparent that a large proportion of the messages received by 
subscribers did not contain an option for recipients to opt-out of future 


marketing messages. 


The Commissioner is satisfied from the evidence she has seen that DGE 
has contravened Regulation 22 PECR for the 16,190 direct marketing 


messages received by subscribers 


Furthermore, the Commissioner is satisfied that the actions of DGE 


have contravened regulation 23 PECR. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 29 February 2020 and 30 
April 2020 a confirmed total of 16,190 direct marketing messages were 
received by subscribers. These messages contained direct marketing 


material for which subscribers had not provided adequate consent. 
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DGE scraped data from an eBay page which had been used by its 

Director dating back to 2003, although it is claimed that only data 

collected in the previous 24 months was used; and harvested the data 

of individuals who had applied for a free sample of its product without 

giving them the opportunity to select whether they would wish to 

receive subsequent direct marketing messages. DGE has failed to 

provide any evidence of valid consent for any of the 16,190 direct 

marketing messages received by subscribers. Furthermore, the 

messages sent by DGE failed to identify itself as the sender, and 

largely failed to provide recipients with the means to opt out of future 


direct marketing. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner does not consider that DGE deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 
Firstly, she has considered whether DGE knew or ought reasonably to 


have known that there was a risk that these contraventions would 


occur. She is satisfied that this condition is met, not least since the 
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issue of unsolicited text messages have been widely publicised by the 


media as being a problem. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 

This guidance gives clear advice regarding the requirements of consent 
for direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular it states that organisations 
can generally only send, or instigate, marketing messages to 


individuals if that person has specifically consented to receiving them. 


It is therefore reasonable to suppose that DGE should have been aware 


of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether DGE 
failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 


Such reasonable steps in these circumstances could have included 

putting in place appropriate systems and procedures to ensure that it 
had the specific consent of those to whom it had sent marketing text 
messages; and adequately recording the source of the data used and 


evidence of any consent obtained. 


Instead, DGE relied almost entirely on data obtained via ‘eBay’ by its 
Director over a sustained period in relation to the auctions of unrelated 
products, including from a time before DGE had even been 
incorporated; these individuals had no relationship with DGE. That 
data was then used to create a marketing list, and used by DGE to 
initiate a text message campaign to sell its own products. DGE has 


provided no evidence that any of the recipients had provided valid 
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consent. Equally, in terms of the data procured from social media 
advertisements, DGE has failed to produce any evidence that the 
individuals who received its direct marketing had provided, or had even 
been capable of providing, valid consent. Furthermore, those 
individuals had not been advised that their data would be used for the 


purpose of direct marketing, and had not been given the opportunity to 


opt out. 


In the circumstances, the Commissioner is satisfied that DGE failed to 


take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has also taken into account the following 


aggravating features of this case: 


The marketing, relating to hand sanitiser suggested by DGE to be 
effective against COVID-19, sought to capitalise on the current 


pandemic; 


The marketing was carried out for the purpose of profiteering and 
financial gain; the Commissioner notes in particular the registration of 
the ‘zoonio.io’ domain on 15 February 2020 and apparent shift towards 
marketing hand sanitiser at a time when demand had soared owing to 


the health crisis; 


The Director, having operated various businesses using similar 
marketing methods, should be familiar with the means by which to carry 
out lawful direct marketing. Those methods were not followed; 
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The Commissioner has found the information provided by the Director 


over the course of the investigation to be unreliable and unclear. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by DGE on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited marketing text messages is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. The issuing of a 
monetary penalty will reinforce the need for businesses to ensure that 
they are only messaging those who specifically consent to receive 


marketing. 
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For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £60,000 (sixty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 23 October 2020 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
22 October 2020 the Commissioner will reduce the monetary penalty 
by 20% to £48,000 (forty eight thousand pounds). However, you 

should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 
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Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 22™ day of September 2020 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 


notice. 
2; If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3; You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 
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LE1 8DJ 


Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 


The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state:- 


a) 


b) 


C) 


d) 


e) 


f) 


g) 


your name and address/name and address of your representative 


(if any); 


an address where documents may be sent or delivered to you; 


the name and address of the Information Commissioner; 


details of the decision to which the proceedings relate; 


the result that you are seeking; 


the grounds on which you rely; 


you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the notice 


of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 
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